PAIA and POPIA Manual

Date of compilation: 2 November 2026 · Applies to: realmarketing (Pty) Ltd, a private body under PAIA

1. About this manual

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives everyone the right to ask for access to records held by a private body, where the record is needed to exercise or protect a right. This manual, prepared under section 51 of PAIA, explains what records realmarketing (Pty) Ltd (“realmarketing”, “we”) holds, how to ask for them, and how we process personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

Every private body, including small businesses, must make a PAIA manual available. We keep this manual short and link to it from our website footer. Please read it together with our Privacy Policy, which gives more detail on how we handle personal information.

2. Our contact details

• Name of private body: realmarketing (Pty) Ltd
• Registration number: 2019/258346/07
• Head of the private body and Information Officer: Hugo Coetzee, Founder and Managing Director (sole director)
• Deputy Information Officer: none appointed
• Email: hugo@realmarketing.co.za
• Phone: +27 82 924 9126
• Physical and postal address: 10C Welgemoed Plaza, 28 Bakker Street, Welgemoed, Cape Town, 7530, South Africa
• Website: realmarketing.co.za

realmarketing is part of GrowthPulse Holdings, together with its sister companies realdigital (Pty) Ltd and Anheluco. Each company is a separate private body, and this manual covers only records held by realmarketing (Pty) Ltd.

3. The Information Regulator’s PAIA Guide

The Information Regulator has published a Guide on how to use PAIA (section 10 of PAIA). It explains how to exercise your rights under PAIA and POPIA, including how to get access to your own personal information, and what remedies are available. The Guide is available in all 11 official languages and in braille. You can download it from the Regulator’s website, inspect it at the Regulator’s offices during office hours, or ask the Regulator for a copy:

• Email: enquiries@inforegulator.org.za
• Phone: 010 023 5200
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Website: inforegulator.org.za

You can also ask us for a copy at hugo@realmarketing.co.za.

4. Records available without a request

The following are freely available on our website, without a PAIA request: our Privacy Policy, our Terms and Conditions, this manual, and information about our services on realmarketing.co.za. All other records must be requested as set out in section 7.

5. Records we keep under other laws

We keep records as required by the following laws, where they apply to us. This list is not exhaustive.

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991
• Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995 and Employment Equity Act 55 of 1998
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Electronic Communications and Transactions Act 25 of 2002
• Consumer Protection Act 68 of 2008
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013

6. Subjects and categories of records we hold

Listing a category here doesn’t mean a record will be released. Access is subject to the grounds for refusal in section 9.

7. How to request access to a record

• Use the prescribed form. Complete Form 2 (Request for access to record) of the PAIA Regulations, 2021. You can download it from the Information Regulator’s website or ask us for a copy.
• Send it to our Information Officer at hugo@realmarketing.co.za, or post or deliver it to the address in section 2.
• Prove who you are. Attach proof of your identity and, if you are asking on behalf of someone else, proof of your authority to do so.
• Describe what you need. Identify the record in enough detail for us to find it, say how you want access (for example, an electronic copy), and explain which right you want to exercise or protect and why you need the record for that (PAIA s53).

If you can’t complete the form because of illiteracy or a disability, you may ask orally and we will complete the form for you and give you a copy. We will decide on your request within 30 days of receiving it (PAIA s56). We may extend this once, by up to 30 days, in the circumstances allowed by PAIA s57, and we will tell you why. If we don’t respond within the time allowed, the request is treated as refused (PAIA s58).

Your own personal information. To ask whether we hold your personal information, or for a copy of it, you can simply email us (POPIA s23). To object to processing, use Form 1 of the POPIA Regulations, 2018. To ask us to correct or delete your information, use Form 2 of the POPIA Regulations, 2018. Both forms are available on the Regulator’s website.

8. Fees

Fees are set by Annexure B of the PAIA Regulations, 2021 (fees for private bodies):

We will tell you in advance if a fee is payable. Fees may change when the Regulations are updated. Fees are payable by EFT, and we will give you our banking details on request.

9. Grounds for refusal

We may or must refuse access to a record in the cases set out in Chapter 4 of Part 3 of PAIA, including where access would:

• unreasonably disclose personal information about another person (s63);
• disclose a third party’s trade secrets, or financial, commercial, scientific or technical information (s64);
• breach a duty of confidence owed to a third party (s65);
• endanger someone’s life or physical safety, or the security of property (s66);
• disclose records that are privileged from production in legal proceedings (s67);
• disclose our own trade secrets, or financial, commercial, scientific or technical information, or harm our commercial or financial interests or negotiations (s68); or
• disclose research information of a third party or of realmarketing (s69).

We must still give access if the public interest override in s70 applies. If we refuse, we will give you reasons. Where a record is partly protected, we will release the rest where we can (s59).

10. Remedies

realmarketing is a private body, so there is no internal appeal. If you are unhappy with our decision, a fee, an extension or a failure to respond, you can:

• complain to the Information Regulator within 180 days (PAIA s77A and s77B), by email to PAIAComplaints@inforegulator.org.za or through its eServices portal at eservices.inforegulator.org.za; or
• apply to a court (PAIA s78), after you have used the complaint procedure with the Regulator.

For complaints about how we process your personal information, email POPIAComplaints@inforegulator.org.za. Please contact us first at hugo@realmarketing.co.za, so that we can try to put things right.

11. How we process personal information (POPIA)

This section sets out the information required by section 51(1)(c) of PAIA. Our Privacy Policy gives more detail.

Purposes of processing

• replying to enquiries and preparing quotes and proposals;
• delivering our marketing services (including digital advertising, SEO, GEO and AEO, content, social media and reporting) and managing client relationships;
• using AI tools, where applicable, to help deliver, report on and improve our services, with a person reviewing all AI-assisted work;
• invoicing, accounting, tax and record-keeping;
• running, securing and improving our website and services;
• direct marketing, only with consent or to existing clients as POPIA s69 allows;
• working with suppliers, freelancers and our sister companies where a project or enquiry involves them;
• considering job applications and managing our staff; and
• meeting legal obligations and protecting our legal rights.

Categories of data subjects and their personal information

We don’t intentionally collect special personal information or information about children. We process our clients’ customers’ personal information only as an operator, under the client’s instructions, and we never put it into AI tools.

Recipients or categories of recipients

• IT, hosting, website, email, communication and file-storage providers;
• AI tool providers, where applicable: xAI (Grok), Anthropic (Claude), OpenAI (ChatGPT) and Google (Gemini), only as described in our Privacy Policy;
• CRM, email-marketing and analytics providers (for example, Zoho CRM, and Google Analytics only if you accept analytics cookies);
• advertising platforms such as Google, YouTube, Meta and LinkedIn, as described in our Privacy Policy;
• professional advisers, such as accountants, auditors, lawyers and insurers;
• subcontractors and freelancers who help deliver client projects, under confidentiality terms;
• companies in GrowthPulse Holdings (for example, realdigital) where a project or enquiry involves them; and
• authorities, where the law requires it.

Planned cross-border transfers

Some of our service providers, including our CRM provider Zoho, the AI tool providers listed above, and cloud, email, analytics and advertising platforms, may store or process personal information outside South Africa. We also work with clients in the United States and the United Arab Emirates. We transfer personal information outside South Africa only where POPIA s72 allows: where the recipient is bound by a law, binding corporate rules or an agreement giving protection substantially similar to POPIA, where the transfer is necessary for a contract with you or in your interest, or where you have consented. For AI tools, we keep personal information to a minimum, and no client confidential information goes into any AI tool unless that client has signed our AI addendum.

Security measures

We take reasonable technical and organisational measures to protect personal information (POPIA s19), including:

• access limited to people who need it, with strong passwords and multi-factor authentication where available;
• encrypted connections (HTTPS) on our website;
• a cookie banner, so that non-essential cookies stay off until you agree;
• training on our data switched off in AI tools where the tool allows, and human review and sign-off of all AI-assisted work;
• regular software updates and backups;
• reputable service providers with their own security controls; and
• confidentiality obligations for our team and subcontractors, and an internal AI use policy for staff and AI agents.

If we believe personal information has been accessed or acquired without authorisation, we will notify the Information Regulator and the people affected as POPIA s22 requires.

12. Availability and updates of this manual

This manual is available free of charge on our website at realmarketing.co.za/paia, linked from the website footer, and at our address in section 2. You can also ask for a copy at hugo@realmarketing.co.za. We will update it when our details or the way we process information change.

Approved by Hugo Coetzee, Founder and Managing Director (head of the private body and Information Officer), on 2 November 2026.